security_doctor 0.6.0

Security audit for Flutter and Dart apps: OWASP MASVS and CWE mapped checks for Dart code, configs and native manifests. Built for CI.

Changelog

0.6.0 - 2026-07-17

Features

• sd001: detect secrets in map entries, parameter defaults and named arguments (#36) (6658f0a), closes #33

Bug Fixes

• rules: locate() skips matches inside XML comments (#35) (a429cac), closes #32

Performance Improvements

• engine: skip ignored directories before descending into them (#34) (2911ae9), closes #31

0.5.1 - 2026-07-11

Bug Fixes

• correct article in SD001 findings for vowel-sound key names (#29) (da14753)

0.5.0 - 2026-07-10

Features

• 16 more known credential formats in SD001 (#25) (1a8c3c9)
• widen the analyzer floor to 8.0.0 (#27) (9454a9e)

0.4.0 - 2026-07-10

Features

• inline suppression comments and smarter string literal analysis (#24) (98097c7)
• rules SD009 (release build shrinking) and SD010 (get-task-allow) (#23) (bdf69e9)
• support analyzer 13 and 14 (#21) (0351f41)

0.3.0 - 2026-07-10

Features

• PCI DSS and ISO 27001 compliance mapping with --compliance report (#19) (fdddf5b)

0.2.0 - 2026-07-10

Features

• baseline support for adopting on existing projects (#12) (c2c3f53)

0.1.0 - 2026-07-10

Features

• rule engine core with console and JSON reports (#1) (252b433)
• rules SD001-SD004 on a lazy Dart AST pass (#3) (a538480)
• rules SD005-SD007 on XML-parsed native configs (#5) (07b911e)
• SARIF and Markdown reports, SD008, vulnerable demo app (#6) (6bfec11)
• project scaffolding: CLI skeleton, CI and release automation (caf6f94)